Systems that periodically emit alerts related to events that occur over a particular analysis period generally attempt to reduce false alerts while avoiding missing important events. In a security system, false positives are generally tolerated for the sake of avoiding a false negative (i.e. missing a security event). However, the number of alerts that can be investigated is limited. Moreover, there are often multiple risk categories, or risk score types, which can trigger an alert, which further contributes to the high volume of alerts which may need to be followed up. There is thus a need for a system which can limit the number of alerts to a manageable amount without missing important events.